Information disclosure in Go programming language - CVE-2023-45289

Vulnerability identifier: #VU87198

CSH Severity: Low

CVSS v4 BT: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-45289

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to insecure forwarding of headers and cookies to a third-party domains in net/http and net/http/cookiejar. A remote attacker can trick the application into sharing sensitive information with an attacker-controlled website.

Go programming language
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
openSUSE Leap
openEuler
Ubuntu
AdGuard Home
IBM Concert Software
IBM Process Mining
Consul
Consul Enterprise
Ansible Automation Platform
Custom Metrics Autoscaler Operator for Red Hat OpenShift
Red Hat OpenShift distributed tracing (RHOSDT)
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Discovery for IBM Cloud Pak for Data
Red Hat Migration Toolkit for Applications
IBM Cloud Pak for Business Automation
IBM Automation Decision Services
IBM Observability with Instana
Operations Dashboard
IBM Business Automation Manager Open Editions
Watson CP4D Data Stores
Storage Protect Server
Storage Protect Plus Container Agent
Storage Protect Plus Server
Business Automation Insights
toolbox (Red Hat package)
conmon-rs (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
butane (Red Hat package)
slirp4netns (Red Hat package)
runc (Red Hat package)
containernetworking-plugins (Red Hat package)
fuse-overlayfs (Red Hat package)
openshift-serverless-clients (Red Hat package)
crun (Red Hat package)
skopeo (Red Hat package)
golang
golang-help
golang-devel
golang-1.21 (Ubuntu package)
golang-1.21-go (Ubuntu package)
golang-1.21-src (Ubuntu package)
delve
go1.21-doc
go1.21
go1.21-race
go-toolset
golang-bin
golang-docs
golang-tests
golang-src
golang-misc
golang (Red Hat package)
golang-shared
go1.21-openssl
go1.21-openssl-doc
go1.21-openssl-race
go1.22-doc
go1.22-race
go1.22
golang-1.22-go (Ubuntu package)
golang-1.22-src (Ubuntu package)
golang-1.22 (Ubuntu package)
dev-lang/go
go1.22-openssl
go1.22-openssl-doc
go1.22-openssl-race
go1.22-openssl-debuginfo
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
containers-common (Red Hat package)
conmon (Red Hat package)
haproxy (Red Hat package)
ignition (Red Hat package)
container-selinux (Red Hat package)
git-lfs-doc
git-lfs
git-lfs (Red Hat package)
libslirp (Red Hat package)
podman (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
openshift4-aws-iso (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
ovn24.03 (Red Hat package)
ostree (Red Hat package)
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
Migration Toolkit for Containers
OpenShift Serverless Client
Red Hat OpenShift Container Platform
Red Hat OpenShift GitOps
Red Hat OpenShift Serverless
IBM Cloud Pak System

Install updates from vendor's website.

Go programming language - addressed in versions 1.21.8, 1.22.1
AdGuard Home - update to 0.107.45
IBM Concert Software - update to 1.0.3
IBM Process Mining - update to 1.15.0 IF002
Consul - addressed in versions 1.16.7, 1.17.4
Consul Enterprise - update to 1.18.1
IBM Business Automation Manager Open Editions - update to 8.0.8
toolbox (Red Hat package) - addressed in versions 0.1.0-2.rhaos4.16.el8, 0.1.2-1.rhaos4.16.el9
conmon-rs (Red Hat package) - addressed in versions 0.6.3-1.rhaos4.16.el8, 0.6.3-1.rhaos4.16.el9
golang-github-prometheus-promu (Red Hat package) - update to 0.15.0-15.2.gitd5383c5.el9
butane (Red Hat package) - update to 0.21.0-1.rhaos4.16.el8
slirp4netns (Red Hat package) - update to 1.1.8-2.rhaos4.16.el8
runc (Red Hat package) - addressed in versions 1.1.12-3.1.rhaos4.16.el8, 1.1.12-3.1.rhaos4.16.el9
OpenShift API for Data Protection (OADP) - update to 1.3.2
containernetworking-plugins (Red Hat package) - update to 1.4.0-2.1.rhaos4.16.el8
Network Observability plugin for the Openshift Console - update to 1.6.0
Migration Toolkit for Containers - update to 1.8.4
fuse-overlayfs (Red Hat package) - update to 1.10-2.rhaos4.16.el8
Red Hat OpenShift GitOps - addressed in versions 1.11.6, 1.12.4
openshift-serverless-clients (Red Hat package) - update to 1.12.0-7.el8
crun (Red Hat package) - addressed in versions 1.14.3-1.rhaos4.16.el8, 1.14.3-1.rhaos4.16.el9
skopeo (Red Hat package) - addressed in versions 1.14.4-1.rhaos4.16.el8, 1.14.4-1.rhaos4.16.el9
golang - update to 1.15.7-39
golang-help - update to 1.15.7-39
golang-devel - update to 1.15.7-39
golang-1.21 (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21-go (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21-src (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
delve - update to 1.21.2-3
go1.21-doc - addressed in versions 1.21.8-1.27.1, 1.21.8-150000.1.27.1
go1.21 - addressed in versions 1.21.8-1.27.1, 1.21.8-150000.1.27.1
go1.21-race - update to 1.21.8-150000.1.27.1
go-toolset - update to 1.21.9-1
golang - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-bin - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-docs - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-tests - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-src - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-misc - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang (Red Hat package) - update to 1.21.9-2.el9_4
golang-shared - update to 1.21.10-2
go1.21-openssl - update to 1.21.13.1-150600.16.3.1
go1.21-openssl-doc - update to 1.21.13.1-150600.16.3.1
go1.21-openssl-race - update to 1.21.13.1-150600.16.3.1
go1.22-doc - update to 1.22.1-150000.1.9.1
go1.22-race - update to 1.22.1-150000.1.9.1
go1.22 - update to 1.22.1-150000.1.9.1
golang-1.22-go (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22-src (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22 (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
dev-lang/go - update to 1.22.3
golang - update to 1.22.3-1
go1.22-openssl - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-doc - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-race - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-debuginfo - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
cri-tools (Red Hat package) - addressed in versions 1.29.0-3.1.el8, 1.29.0-3.1.el9
cri-o (Red Hat package) - addressed in versions 1.29.5-5.rhaos4.16.git7032128.el8, 1.29.5-5.rhaos4.16.git7032128.el9
OpenShift Serverless Client - update to 1.33.0
Red Hat OpenShift Serverless - update to 1.33.0
buildah (Red Hat package) - addressed in versions 1.33.7-1.1.rhaos4.16.el8, 1.33.7-1.1.rhaos4.16.el9
containers-common (Red Hat package) - addressed in versions 1-77.rhaos4.16.el8, 1-77.rhaos4.16.el9
conmon (Red Hat package) - addressed in versions 2.1.10-2.1.rhaos4.16.el8, 2.1.10-2.1.rhaos4.16.el9
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
Ansible Automation Platform - update to 2.4
haproxy (Red Hat package) - addressed in versions 2.6.13-3.rhaos4.16.el8, 2.8.5-2.rhaos4.16.el9
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-394
ignition (Red Hat package) - update to 2.18.0-2.1.rhaos4.16.el9
container-selinux (Red Hat package) - addressed in versions 2.231.0-1.rhaos4.16.el8, 2.231.0-1.rhaos4.16.el9
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.2.0
git-lfs-doc - addressed in versions 3.4.1-1.0.1, 3.4.1-2.0.1
git-lfs - addressed in versions 3.4.1-1.0.1, 3.4.1-2.0.1
git-lfs (Red Hat package) - addressed in versions 3.4.1-2.el8_10, 3.4.1-2.el9_4
libslirp (Red Hat package) - update to 4.4.0-4.rhaos4.16.el8
Red Hat Advanced Cluster Security for Kubernetes - update to 4.4.2
podman (Red Hat package) - addressed in versions 4.9.4-5.1.rhaos4.16.el8, 4.9.4-5.1.rhaos4.16.el9
Red Hat OpenShift Container Platform - addressed in versions 4.13.45, 4.13.46, 4.14.32, 4.14.33, 4.14.34, 4.16.0, 4.16.1, 4.17.0
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202404181812.p0.g26b43df.assembly.stream.el8, 4.16.0-202404181812.p0.g26b43df.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.16.0-202404181812.p0.g7806532.assembly.stream.el8, 4.16.0-202404181812.p0.g7806532.assembly.stream.el9
openshift4-aws-iso (Red Hat package) - update to 4.16.0-202404181812.p0.gd2acdd5.assembly.stream.el8
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202404301345.p0.g0e95532.assembly.stream.el8, 4.16.0-202404301345.p0.g0e95532.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el8, 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.16.0-202406052127.p0.ga245041.assembly.stream.el8, 4.16.0-202406052127.p0.ga245041.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8, 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.0.0
Watson CP4D Data Stores - update to 5.0.3
Red Hat Migration Toolkit for Applications - update to 7.0.3
Storage Protect Server - update to 8.1.23
Storage Protect Plus Container Agent - update to 10.1.12.7
Storage Protect Plus Server - update to 10.1.16.2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF037, 24.0.0-IF003
Business Automation Insights - update to 24.0.0.0.1
IBM Automation Decision Services - update to 24.0.0.0.3
ovn24.03 (Red Hat package) - update to 24.03.2-19.el9fdp
IBM Observability with Instana - update to 279
Operations Dashboard - update to 2022.2.1-24
ostree (Red Hat package) - update to 2024.1-2.el9

• https://go.dev/issue/65065
• https://go.dev/cl/569340
• https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• https://pkg.go.dev/vuln/GO-2024-2600

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in AdGuardHome
• SUSE update for go1.21
• SUSE update for go1.22
• SUSE update for go1.21
• openEuler update for golang
• Multiple vulnerabilities in Consul
• Multiple vulnerabilities in HashiCorp Consul
• Red Hat Enterprise Linux 9 update for golang
• Multiple vulnerabilities in IBM Storage Protect Plus Container Agent
• Red Hat Enterprise Linux 9 update for git-lfs
• Red Hat Enterprise Linux 8 update for git-lfs
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in OpenShift Serverless Client 1.33
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.33
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Ubuntu update for golang-1.21
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Amazon Linux AMI update for golang
• Gentoo update for Go
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Storage Protect Plus Server
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in Operations Dashboard
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Observability with Instana
• IBM Watson CP4D Data Stores update for Golang Go
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• SUSE update for go1.21-openssl
• Multiple vulnerabilities in IBM Cloud Pak System
• SUSE update for go1.22-openssl
• Multiple vulnerabilities in IBM Business Automation Insights
• SUSE update for go1.22-openssl
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Automation Decision Services
• Anolis OS update for go-toolset:an8 module
• Anolis OS update for git-lfs
• Anolis OS update for golang
• Anolis OS update for git-lfs
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0
• Multiple vulnerabilities in Red Hat OpenShift distributed tracing (RHOSDT) 3.2